Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
29/12/2021, 09:19
Static task
static1
Behavioral task
behavioral1
Sample
image.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
image.exe
-
Size
516KB
-
MD5
e60ded83982043932447eba0a568273c
-
SHA1
835cfdbebbbcd44985572d5690d3dbcd8f041bbc
-
SHA256
6dd4d7a668ac56bb6e71090d32a522e77c885e540758ed08ac03d702b02f26dd
-
SHA512
b4055f3994ea402eb81a8b7d5824e6d778c4335f99fcef8625fa8166eb9ea55bc2398e137695a4b21efed5711e7acd5a7f2e36fe1179b221abb71807b8bb729c
Malware Config
Signatures
-
Kutaki Executable 4 IoCs
resource yara_rule behavioral1/files/0x0006000000014049-58.dat family_kutaki behavioral1/files/0x0006000000014049-59.dat family_kutaki behavioral1/files/0x0006000000014049-61.dat family_kutaki behavioral1/files/0x0006000000014049-71.dat family_kutaki -
Executes dropped EXE 1 IoCs
pid Process 1456 xymnqlch.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xymnqlch.exe image.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xymnqlch.exe image.exe -
Loads dropped DLL 2 IoCs
pid Process 968 image.exe 968 image.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main xymnqlch.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1980 DllHost.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 968 image.exe 968 image.exe 968 image.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe 1456 xymnqlch.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 968 wrote to memory of 688 968 image.exe 28 PID 968 wrote to memory of 688 968 image.exe 28 PID 968 wrote to memory of 688 968 image.exe 28 PID 968 wrote to memory of 688 968 image.exe 28 PID 968 wrote to memory of 1456 968 image.exe 30 PID 968 wrote to memory of 1456 968 image.exe 30 PID 968 wrote to memory of 1456 968 image.exe 30 PID 968 wrote to memory of 1456 968 image.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\image.exe"C:\Users\Admin\AppData\Local\Temp\image.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp2⤵PID:688
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xymnqlch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xymnqlch.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:1980